cyclo-manager 0.4.0.dev0__tar.gz → 1.0.0.dev1__tar.gz

{cyclo_manager-0.4.0.dev0 → cyclo_manager-1.0.0.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cyclo-manager
-Version: 0.4.0.dev0
+Version: 1.0.0.dev1
 Summary: cyclo_manager CLI: pip-installable launcher for cyclo_manager server and UI containers. Run 'cyclo_manager up' to start Docker stack.
 License-Expression: Apache-2.0
 Requires-Python: >=3.10
@@ -52,9 +52,9 @@ For the full monorepo (API source, UI source, dev compose), see the [repository
 
 - **Docker** with **Compose v2** (`docker compose` — the legacy `docker-compose` binary alone is not enough)
 - **Python 3.10+**
-- **`sudo`** — required to install the host agent systemd unit, socket directory permissions, and sudoers rules
+- **`sudo`** — required on normal-user hosts to install the host agent systemd unit, socket directory permissions, and sudoers rules
 - For **`cyclo_manager update`:** **`pip`** or **`pip3`** on `PATH`
-- **Do not run as root** — the host agent runs as the invoking user (or `SUDO_USER` when using `sudo cyclo_manager up`). Running as root is rejected.
+- **Root shell handling** — root is rejected when a normal login user exists. On root-only devices, the host agent is installed as root.
 - **Agent sockets** on the host under `/var/run/robotis/agent_sockets/` (robot containers and host agent). The bundled Compose file bind-mounts this tree into the API container as `/agents/`.
 
 ---
@@ -120,7 +120,7 @@ The pip package installs a small **FastAPI** server that listens on a **Unix dom
 |------|------|
 | Socket | `/var/run/robotis/agent_sockets/host/host_agent.sock` |
 | systemd unit | `cyclo_host_agent.service` |
-| sudoers | `/etc/sudoers.d/cyclo_manager` (`cp`, `udevadm` for container setup scripts) |
+| sudoers | `/etc/sudoers.d/cyclo_manager` (`cp`, `udevadm` for container setup scripts; skipped on root-only devices) |
 
 The API container reaches it at `/agents/host/host_agent.sock` (see bundled `config.yml`).
 
@@ -131,6 +131,8 @@ The API container reaches it at `/agents/host/host_agent.sock` (see bundled `con
 
 `cyclo_manager up` and `cyclo_manager update` both call `_ensure_host_agent()`, which is idempotent — safe to run after upgrades or user changes.
 
+Repository scanning uses `CYCLO_HOST_AGENT_WORKSPACE` when set. Otherwise it uses the service user's home directory, except root-only devices with `/data/docker`, where `/data/docker` is used automatically.
+
 ---
 
 ## Compose services
@@ -160,7 +162,7 @@ The API reads it as `CONFIG_FILE=/app/config.yml` inside the container.
 
 | Key | Description |
 |-----|-------------|
-| **`robot_container`** | Primary robot Docker container name (e.g. `ai_worker`). Used by the UI System page and service bringup. Must be a key in `sockets` and cannot be `host_agent`. |
+| **`supported_robot_containers`** | Robot Docker container names that can open the System page (e.g. `ai_worker`, `open_manipulator`). Each must be a key in `sockets` and cannot be `host_agent`. |
 | **`sockets`** | Map of logical name → agent **Unix socket path as seen inside the API container** (under `/agents/...`). Include robot/service containers and `host_agent`. |
 
 s6 **service names** are not listed in config; each in-container agent reports them at runtime.
@@ -168,20 +170,17 @@ s6 **service names** are not listed in config; each in-container agent reports t
 ### Example (bundled default)
 
 ```yaml
-robot_container: ai_worker
+supported_robot_containers:
+  - ai_worker
+  - open_manipulator
 
 sockets:
   ai_worker: "/agents/ai_worker/s6_agent.sock"
+  open_manipulator: "/agents/open_manipulator/s6_agent.sock"
   cyclo_intelligence: "/agents/cyclo_intelligence/s6_agent.sock"
   host_agent: "/agents/host/host_agent.sock"
 ```
 
-### Validation (API startup)
-
-- At least one socket entry besides `host_agent`
-- `robot_container` must exist in `sockets`
-- All socket paths must be non-empty strings
-
 To use a different config layout, mounts, or local source builds, use the repository’s **`docker-compose.dev.yml`** — see [Custom config and development](#custom-config-and-development).
 
 ---

{cyclo_manager-0.4.0.dev0 → cyclo_manager-1.0.0.dev1}/README.md

@@ -38,9 +38,9 @@ For the full monorepo (API source, UI source, dev compose), see the [repository
 
 - **Docker** with **Compose v2** (`docker compose` — the legacy `docker-compose` binary alone is not enough)
 - **Python 3.10+**
-- **`sudo`** — required to install the host agent systemd unit, socket directory permissions, and sudoers rules
+- **`sudo`** — required on normal-user hosts to install the host agent systemd unit, socket directory permissions, and sudoers rules
 - For **`cyclo_manager update`:** **`pip`** or **`pip3`** on `PATH`
-- **Do not run as root** — the host agent runs as the invoking user (or `SUDO_USER` when using `sudo cyclo_manager up`). Running as root is rejected.
+- **Root shell handling** — root is rejected when a normal login user exists. On root-only devices, the host agent is installed as root.
 - **Agent sockets** on the host under `/var/run/robotis/agent_sockets/` (robot containers and host agent). The bundled Compose file bind-mounts this tree into the API container as `/agents/`.
 
 ---
@@ -106,7 +106,7 @@ The pip package installs a small **FastAPI** server that listens on a **Unix dom
 |------|------|
 | Socket | `/var/run/robotis/agent_sockets/host/host_agent.sock` |
 | systemd unit | `cyclo_host_agent.service` |
-| sudoers | `/etc/sudoers.d/cyclo_manager` (`cp`, `udevadm` for container setup scripts) |
+| sudoers | `/etc/sudoers.d/cyclo_manager` (`cp`, `udevadm` for container setup scripts; skipped on root-only devices) |
 
 The API container reaches it at `/agents/host/host_agent.sock` (see bundled `config.yml`).
 
@@ -117,6 +117,8 @@ The API container reaches it at `/agents/host/host_agent.sock` (see bundled `con
 
 `cyclo_manager up` and `cyclo_manager update` both call `_ensure_host_agent()`, which is idempotent — safe to run after upgrades or user changes.
 
+Repository scanning uses `CYCLO_HOST_AGENT_WORKSPACE` when set. Otherwise it uses the service user's home directory, except root-only devices with `/data/docker`, where `/data/docker` is used automatically.
+
 ---
 
 ## Compose services
@@ -146,7 +148,7 @@ The API reads it as `CONFIG_FILE=/app/config.yml` inside the container.
 
 | Key | Description |
 |-----|-------------|
-| **`robot_container`** | Primary robot Docker container name (e.g. `ai_worker`). Used by the UI System page and service bringup. Must be a key in `sockets` and cannot be `host_agent`. |
+| **`supported_robot_containers`** | Robot Docker container names that can open the System page (e.g. `ai_worker`, `open_manipulator`). Each must be a key in `sockets` and cannot be `host_agent`. |
 | **`sockets`** | Map of logical name → agent **Unix socket path as seen inside the API container** (under `/agents/...`). Include robot/service containers and `host_agent`. |
 
 s6 **service names** are not listed in config; each in-container agent reports them at runtime.
@@ -154,20 +156,17 @@ s6 **service names** are not listed in config; each in-container agent reports t
 ### Example (bundled default)
 
 ```yaml
-robot_container: ai_worker
+supported_robot_containers:
+  - ai_worker
+  - open_manipulator
 
 sockets:
   ai_worker: "/agents/ai_worker/s6_agent.sock"
+  open_manipulator: "/agents/open_manipulator/s6_agent.sock"
   cyclo_intelligence: "/agents/cyclo_intelligence/s6_agent.sock"
   host_agent: "/agents/host/host_agent.sock"
 ```
 
-### Validation (API startup)
-
-- At least one socket entry besides `host_agent`
-- `robot_container` must exist in `sockets`
-- All socket paths must be non-empty strings
-
 To use a different config layout, mounts, or local source builds, use the repository’s **`docker-compose.dev.yml`** — see [Custom config and development](#custom-config-and-development).
 
 ---

{cyclo_manager-0.4.0.dev0 → cyclo_manager-1.0.0.dev1}/cyclo_host_agent/routers/repos.py

@@ -43,14 +43,17 @@ router = APIRouter(prefix='/repos', tags=['repos'])
 GIT_TIMEOUT = 120.0
 
 
-def _resolve_home() -> Path:
+def _resolve_workspace() -> Path:
+    configured_workspace = os.environ.get('CYCLO_HOST_AGENT_WORKSPACE')
+    if configured_workspace:
+        return Path(configured_workspace).expanduser()
     sudo_user = os.environ.get('SUDO_USER')
     if sudo_user:
         return Path(f'/home/{sudo_user}')
     return Path.home()
 
 
-WORKSPACE_PATH = _resolve_home()
+WORKSPACE_PATH = _resolve_workspace()
 MANAGED_GITHUB_ORG = 'ROBOTIS-GIT'
 ALLOWED_UPDATE_BRANCHES = frozenset({'main', 'jazzy'})
 

{cyclo_manager-0.4.0.dev0 → cyclo_manager-1.0.0.dev1}/cyclo_manager.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cyclo-manager
-Version: 0.4.0.dev0
+Version: 1.0.0.dev1
 Summary: cyclo_manager CLI: pip-installable launcher for cyclo_manager server and UI containers. Run 'cyclo_manager up' to start Docker stack.
 License-Expression: Apache-2.0
 Requires-Python: >=3.10
@@ -52,9 +52,9 @@ For the full monorepo (API source, UI source, dev compose), see the [repository
 
 - **Docker** with **Compose v2** (`docker compose` — the legacy `docker-compose` binary alone is not enough)
 - **Python 3.10+**
-- **`sudo`** — required to install the host agent systemd unit, socket directory permissions, and sudoers rules
+- **`sudo`** — required on normal-user hosts to install the host agent systemd unit, socket directory permissions, and sudoers rules
 - For **`cyclo_manager update`:** **`pip`** or **`pip3`** on `PATH`
-- **Do not run as root** — the host agent runs as the invoking user (or `SUDO_USER` when using `sudo cyclo_manager up`). Running as root is rejected.
+- **Root shell handling** — root is rejected when a normal login user exists. On root-only devices, the host agent is installed as root.
 - **Agent sockets** on the host under `/var/run/robotis/agent_sockets/` (robot containers and host agent). The bundled Compose file bind-mounts this tree into the API container as `/agents/`.
 
 ---
@@ -120,7 +120,7 @@ The pip package installs a small **FastAPI** server that listens on a **Unix dom
 |------|------|
 | Socket | `/var/run/robotis/agent_sockets/host/host_agent.sock` |
 | systemd unit | `cyclo_host_agent.service` |
-| sudoers | `/etc/sudoers.d/cyclo_manager` (`cp`, `udevadm` for container setup scripts) |
+| sudoers | `/etc/sudoers.d/cyclo_manager` (`cp`, `udevadm` for container setup scripts; skipped on root-only devices) |
 
 The API container reaches it at `/agents/host/host_agent.sock` (see bundled `config.yml`).
 
@@ -131,6 +131,8 @@ The API container reaches it at `/agents/host/host_agent.sock` (see bundled `con
 
 `cyclo_manager up` and `cyclo_manager update` both call `_ensure_host_agent()`, which is idempotent — safe to run after upgrades or user changes.
 
+Repository scanning uses `CYCLO_HOST_AGENT_WORKSPACE` when set. Otherwise it uses the service user's home directory, except root-only devices with `/data/docker`, where `/data/docker` is used automatically.
+
 ---
 
 ## Compose services
@@ -160,7 +162,7 @@ The API reads it as `CONFIG_FILE=/app/config.yml` inside the container.
 
 | Key | Description |
 |-----|-------------|
-| **`robot_container`** | Primary robot Docker container name (e.g. `ai_worker`). Used by the UI System page and service bringup. Must be a key in `sockets` and cannot be `host_agent`. |
+| **`supported_robot_containers`** | Robot Docker container names that can open the System page (e.g. `ai_worker`, `open_manipulator`). Each must be a key in `sockets` and cannot be `host_agent`. |
 | **`sockets`** | Map of logical name → agent **Unix socket path as seen inside the API container** (under `/agents/...`). Include robot/service containers and `host_agent`. |
 
 s6 **service names** are not listed in config; each in-container agent reports them at runtime.
@@ -168,20 +170,17 @@ s6 **service names** are not listed in config; each in-container agent reports t
 ### Example (bundled default)
 
 ```yaml
-robot_container: ai_worker
+supported_robot_containers:
+  - ai_worker
+  - open_manipulator
 
 sockets:
   ai_worker: "/agents/ai_worker/s6_agent.sock"
+  open_manipulator: "/agents/open_manipulator/s6_agent.sock"
   cyclo_intelligence: "/agents/cyclo_intelligence/s6_agent.sock"
   host_agent: "/agents/host/host_agent.sock"
 ```
 
-### Validation (API startup)
-
-- At least one socket entry besides `host_agent`
-- `robot_container` must exist in `sockets`
-- All socket paths must be non-empty strings
-
 To use a different config layout, mounts, or local source builds, use the repository’s **`docker-compose.dev.yml`** — see [Custom config and development](#custom-config-and-development).
 
 ---

{cyclo_manager-0.4.0.dev0 → cyclo_manager-1.0.0.dev1}/cyclo_manager_cli/cli.py

@@ -26,6 +26,7 @@ Launches cyclo_manager server and UI via Docker.
 import argparse
 import os
 from pathlib import Path
+import pwd
 import shutil
 import socket
 import subprocess
@@ -40,6 +41,7 @@ HOST_AGENT_SOCKET_DIR = '/var/run/robotis/agent_sockets/host'
 COMPOSE_SERVICES_UP = ('cyclo_manager', 'ui')
 # These get `docker compose create` only (stopped); start from UI or `docker start`.
 COMPOSE_SERVICES_CREATE_ONLY = ('rmw_zenoh', 'novnc-server')
+DISABLED_LOGIN_SHELLS = {'', '/bin/false', '/sbin/nologin', '/usr/sbin/nologin'}
 
 
 def _docker_dir() -> Path:
@@ -55,6 +57,47 @@ def _packaged_config_path() -> Path:
     return _config_dir() / 'config.yml'
 
 
+def _privileged_cmd(args: list[str]) -> list[str]:
+    """Return args prefixed with sudo when the current process is not already root."""
+    if os.geteuid() == 0:
+        return args
+    return ['sudo', *args]
+
+
+def _user_home(user: str) -> Path:
+    """Return a user's home directory from passwd, with a conservative fallback."""
+    try:
+        return Path(pwd.getpwnam(user).pw_dir)
+    except KeyError:
+        if user == 'root':
+            return Path('/root')
+        return Path(f'/home/{user}')
+
+
+def _has_normal_login_user() -> bool:
+    """Return True when the host has a non-root login user."""
+    for account in pwd.getpwall():
+        if account.pw_name == 'root':
+            continue
+        if account.pw_uid < 1000 or account.pw_uid >= 65534:
+            continue
+        if account.pw_shell in DISABLED_LOGIN_SHELLS:
+            continue
+        return True
+    return False
+
+
+def _host_agent_workspace(user: str, user_home: Path) -> Path:
+    """Return the workspace path the host agent should scan for git repositories."""
+    configured_workspace = os.environ.get('CYCLO_HOST_AGENT_WORKSPACE')
+    if configured_workspace:
+        return Path(configured_workspace).expanduser()
+    data_docker = Path('/data/docker')
+    if user == 'root' and data_docker.is_dir():
+        return data_docker
+    return user_home
+
+
 def _resolve_service_user() -> tuple[str, Path] | None:
     """
     Return (username, home) for the host agent systemd service.
@@ -64,9 +107,15 @@ def _resolve_service_user() -> tuple[str, Path] | None:
     """
     sudo_user = os.environ.get('SUDO_USER')
     if sudo_user:
-        return sudo_user, Path(f'/home/{sudo_user}')
-    user = os.environ.get('USER') or os.getlogin()
+        return sudo_user, _user_home(sudo_user)
+    user = os.environ.get('USER') or pwd.getpwuid(os.getuid()).pw_name
     if user == 'root':
+        if not _has_normal_login_user():
+            print(
+                'Info: root-only device detected; cyclo_host_agent will run as root.',
+                file=sys.stderr,
+            )
+            return 'root', Path('/root')
         print(
             'Error: cyclo_manager up must run as a normal user (e.g. robotis), not root.',
             file=sys.stderr,
@@ -85,19 +134,19 @@ def _setup_socket_dir(user: str) -> bool:
     print(f'  [1/3] Creating socket directory {HOST_AGENT_SOCKET_DIR}...')
     try:
         subprocess.run(
-            ['sudo', 'mkdir', '-p', HOST_AGENT_SOCKET_DIR],
+            _privileged_cmd(['mkdir', '-p', HOST_AGENT_SOCKET_DIR]),
             check=True,
             capture_output=True,
         )
         print(f'  [2/3] Setting ownership to {user}:{user}...')
         subprocess.run(
-            ['sudo', 'chown', f'{user}:{user}', HOST_AGENT_SOCKET_DIR],
+            _privileged_cmd(['chown', f'{user}:{user}', HOST_AGENT_SOCKET_DIR]),
             check=True,
             capture_output=True,
         )
         print('  [3/3] Removing stale socket file (if any)...')
         subprocess.run(
-            ['sudo', 'rm', '-f', HOST_AGENT_SOCKET],
+            _privileged_cmd(['rm', '-f', HOST_AGENT_SOCKET]),
             check=True,
             capture_output=True,
         )
@@ -123,13 +172,13 @@ def _install_sudoers(user: str) -> bool:
     sudoers_file = '/etc/sudoers.d/cyclo_manager'
     try:
         subprocess.run(
-            ['sudo', 'tee', sudoers_file],
+            _privileged_cmd(['tee', sudoers_file]),
             input=sudoers_content.encode(),
             capture_output=True,
             check=True,
         )
         subprocess.run(
-            ['sudo', 'chmod', '440', sudoers_file],
+            _privileged_cmd(['chmod', '440', sudoers_file]),
             check=True,
             capture_output=True,
         )
@@ -151,6 +200,7 @@ def _ensure_host_agent() -> int:
         return 1
 
     user, user_home = account
+    workspace_path = _host_agent_workspace(user, user_home)
     agent_exe = shutil.which('cyclo_host_agent')
     if not agent_exe:
         print(
@@ -163,7 +213,7 @@ def _ensure_host_agent() -> int:
     if not _setup_socket_dir(user):
         return 1
 
-    if not _install_sudoers(user):
+    if user != 'root' and not _install_sudoers(user):
         return 1
 
     service_content = f"""\
@@ -179,6 +229,7 @@ RuntimeDirectory=robotis/agent_sockets/host
 RuntimeDirectoryMode=0755
 ExecStart={agent_exe}
 Environment=HOME={user_home}
+Environment=CYCLO_HOST_AGENT_WORKSPACE={workspace_path}
 Restart=always
 RestartSec=3
 
@@ -192,22 +243,26 @@ WantedBy=multi-user.target
     try:
         print(f'  Writing unit file to {service_file}...')
         subprocess.run(
-            ['sudo', 'tee', service_file],
+            _privileged_cmd(['tee', service_file]),
             input=service_content.encode(),
             capture_output=True,
             check=True,
         )
         print('  Running systemctl daemon-reload...')
-        subprocess.run(['sudo', 'systemctl', 'daemon-reload'], check=True, capture_output=True)
+        subprocess.run(
+            _privileged_cmd(['systemctl', 'daemon-reload']),
+            check=True,
+            capture_output=True,
+        )
         print(f'  Enabling {HOST_AGENT_SERVICE}...')
         subprocess.run(
-            ['sudo', 'systemctl', 'enable', f'{HOST_AGENT_SERVICE}.service'],
+            _privileged_cmd(['systemctl', 'enable', f'{HOST_AGENT_SERVICE}.service']),
             check=True,
             capture_output=True,
         )
         print(f'  Starting {HOST_AGENT_SERVICE}...')
         subprocess.run(
-            ['sudo', 'systemctl', 'restart', f'{HOST_AGENT_SERVICE}.service'],
+            _privileged_cmd(['systemctl', 'restart', f'{HOST_AGENT_SERVICE}.service']),
             check=True,
             capture_output=True,
         )
@@ -217,7 +272,7 @@ WantedBy=multi-user.target
         print(f'Failed to install host agent service: {e}', file=sys.stderr)
         return 1
     except FileNotFoundError:
-        print('sudo not found. Install the host agent service manually.', file=sys.stderr)
+        print('Required command not found. Install the host agent service manually.', file=sys.stderr)
         return 1
 
 
@@ -272,15 +327,21 @@ def _teardown_host_agent() -> None:
     """Stop and remove the host agent service, unit file, sudoers, and socket dir."""
     print(f'Tearing down {HOST_AGENT_SERVICE}...')
     steps = [
-        (['sudo', 'systemctl', 'stop', f'{HOST_AGENT_SERVICE}.service'], 'stop service'),
-        (['sudo', 'systemctl', 'disable', f'{HOST_AGENT_SERVICE}.service'], 'disable service'),
         (
-            ['sudo', 'rm', '-f', f'/etc/systemd/system/{HOST_AGENT_SERVICE}.service'],
+            _privileged_cmd(['systemctl', 'stop', f'{HOST_AGENT_SERVICE}.service']),
+            'stop service',
+        ),
+        (
+            _privileged_cmd(['systemctl', 'disable', f'{HOST_AGENT_SERVICE}.service']),
+            'disable service',
+        ),
+        (
+            _privileged_cmd(['rm', '-f', f'/etc/systemd/system/{HOST_AGENT_SERVICE}.service']),
             'remove unit file',
         ),
-        (['sudo', 'systemctl', 'daemon-reload'], 'daemon-reload'),
-        (['sudo', 'rm', '-f', '/etc/sudoers.d/cyclo_manager'], 'remove sudoers'),
-        (['sudo', 'rm', '-rf', HOST_AGENT_SOCKET_DIR], 'remove socket dir'),
+        (_privileged_cmd(['systemctl', 'daemon-reload']), 'daemon-reload'),
+        (_privileged_cmd(['rm', '-f', '/etc/sudoers.d/cyclo_manager']), 'remove sudoers'),
+        (_privileged_cmd(['rm', '-rf', HOST_AGENT_SOCKET_DIR]), 'remove socket dir'),
     ]
     for cmd, desc in steps:
         print(f'  {desc}...')

{cyclo_manager-0.4.0.dev0 → cyclo_manager-1.0.0.dev1}/cyclo_manager_cli/config/config.yml

@@ -1,8 +1,11 @@
 # cyclo_manager Configuration
 
-robot_container: ai_worker
+supported_robot_containers:
+  - ai_worker
+  - open_manipulator
 
 sockets:
   ai_worker: "/agents/ai_worker/s6_agent.sock"
+  open_manipulator: "/agents/open_manipulator/s6_agent.sock"
   cyclo_intelligence: "/agents/cyclo_intelligence/s6_agent.sock"
   host_agent: "/agents/host/host_agent.sock"

{cyclo_manager-0.4.0.dev0 → cyclo_manager-1.0.0.dev1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cyclo-manager"
-version = "0.4.0.dev0"
+version = "1.0.0.dev1"
 description = "cyclo_manager CLI: pip-installable launcher for cyclo_manager server and UI containers. Run 'cyclo_manager up' to start Docker stack."
 readme = "README.md"
 license = "Apache-2.0"